Privacy Policy

1. General provisions

This Privacy Policy describes how personal data is processed when you use the MalishOK website and mobile application.

The Policy is prepared with regard to the applicable personal-data legislation of the Russian Federation and the principles of data minimisation, purpose limitation and restricted access.

Personal-data operator: Individual Entrepreneur Yulia Tsaplina (the “Operator”).

2. Terms and scope

A User is a parent, legal representative or another person who creates an account and uses MalishOK to keep records about a child.

Personal data means information relating directly or indirectly to an identified or identifiable person.

User Content includes records, photos, notes, development information, routines, health information, vaccinations, medication, doctor visits and other events entered by the User.

This Policy applies to the website, mobile application, account, encrypted cloud backup, support requests and future paid features.

3. Storage architecture and minimisation

MalishOK is designed around local storage: the main content of a child diary is created and kept on the User’s device.

The Operator does not store a child’s name, date of birth, photos, medical records, diary notes, sleep, feeding, diaper, height, weight, medication, vaccination, doctor-visit or development records in readable form unless the User deliberately sends them to support or otherwise provides them explicitly.

When cloud backup is enabled, User Content is encrypted on the device before transmission. The server receives only the account identifier, encrypted backup ciphertext and technical encryption parameters needed to operate the backup; separate diary fields, photos and medical records are not transmitted.

Decryption takes place only on the User’s device. The Operator does not receive the decryption key and cannot view, search or use the contents of a backup.

If the User loses the password, recovery key and the old device or another secret required for decryption, the Operator may be technically unable to restore the backup.

4. Categories of personal data

Depending on the features selected, the Operator may process the following categories of data:

5. Purposes of processing

• Creating, confirming, securing and administering the User’s account.
• Providing access to the application and its features.
• Authentication through email/password, Google or Apple.
• Creating, storing and restoring an encrypted backup at the User’s request.
• Issuing, checking and ending PRO access, promo codes and entitlements when enabled.
• Handling support requests, diagnosing errors and improving stability.
• Preventing abuse and protecting the account and infrastructure.
• Complying with applicable law and lawful requests from authorised bodies.

6. Legal grounds

The Operator processes personal data on one or more of the following grounds:

• The User’s consent to personal-data processing and this Policy.
• Performance of the User Agreement and provision of the service.
• The need to create and protect an account, fulfil a request, provide support and restore access.
• Compliance with legal obligations.
• The Operator’s legitimate interest in service security, abuse prevention and technical quality, subject to the User’s rights.

7. Localisation, processors and third parties

MalishOK server infrastructure is located in the Russian Federation. Where required by applicable law, the Operator ensures the recording, systematisation, accumulation, storage, updating and retrieval of Russian citizens’ personal data using databases located in the Russian Federation.

Google and Apple may be used for authentication. When the User chooses one of these methods, the User interacts directly with that provider; the Operator receives only identifiers and data needed to create or access the account.

AppMetrica is used for technical and product analytics. Child names, photos, medical records, notes and diary contents are not sent to analytics.

Personal data may be disclosed to third parties only to the extent necessary for the stated purposes, under a contract, processing instruction, User action or legal requirement.

8. Special categories and children’s data

User Content may include information about a child’s health and other sensitive family information. It is processed locally on the User’s device. When backup is enabled, the server receives only ciphertext inaccessible to the Operator, not separate diary entries.

The Operator does not ask a child to provide personal data independently and does not design the service for children to use without a parent or legal representative.

The User confirms that they have the rights and authority required to enter and manage information about the child.

9. Cookies, local storage and device data

The website and application may use cookies, localStorage, IndexedDB, technical tokens and similar mechanisms on the device for authentication, settings, the local diary, backup, security and diagnostics.

Disabling cookies or local storage may prevent sign-in, remove local settings or affect some features.

Device and browser data is used only to the extent reasonably necessary for compatibility, security and troubleshooting.

10. Retention and deletion

• Account data is kept until the account is deleted, consent is withdrawn, use of the service ends or the processing purposes are fulfilled.
• After account deletion, active account data is deleted or anonymised within 30 calendar days unless a longer period is required by law.
• Encrypted backups, technical logs and archives may be kept for up to 90 calendar days to protect against accidental loss, investigate incidents and restore the service.
• Support data is kept for the period necessary to handle the request and protect the rights of the Operator or User.
• Aggregated analytics that cannot identify a particular User may be retained without a time limit.

11. User rights

The User may request information about processing, correction, blocking, deletion or destruction of personal data and a copy of information required by applicable law.

Requests may be sent to malishokpro@proton.me. To protect the account, the Operator may request proof of email ownership or additional identification.

The User may also delete the account and available backup through the mechanisms provided in the application or by contacting support.

12. Security measures

The Operator applies organisational and technical measures appropriate to the risks, including access control, authentication protection, encrypted transmission, encrypted backups, logging and restricted access by support personnel.

No method of storage or transmission can guarantee absolute security.

13. Changes to this Policy

The Operator may update this Policy when the service, law or processing purposes change. Material changes are announced through the service or another available channel where reasonably possible.

The current version is published on this page.

14. Contacts

• Email: malishokpro@proton.me
• Operator: Individual Entrepreneur Yulia Tsaplina